Security Risk & Compliance (Agent Security)

Join Anthropic's Security Governance, Risk, and Compliance (GRC) team as a Security Risk & Compliance professional. In this role, you will be responsible for authoring security policies and standards for AI agent governance, defining review and approval criteria for sensitive data interactions, and monitoring agent behavior over time. You will also map agent security and data controls to AI governance frameworks, assess and document agent-related security and compliance risks, and own the policy for agent-related risk acceptances and exceptions. This position offers comprehensive benefits, including health insurance, paid parental leave, flexible paid time off, and competitive salary and equity packages.

• Serve as the security policy partner for AI agent governance, authoring the policies and standards for how agents are built, deployed, operated.
• Define review and approval criteria when an agent may interact with sensitive or regulated data, and which actions require human approval as it relates to compliance frameworks.
• Monitor agent behavior over time and adapt governance requirements in partnership with cross-functional security, research and engineering teams.

• Have 8+ years in security governance, risk, and compliance, including ownership of security policies and control standards at a technology company
• Have defined risk-based review or approval criteria within engineering workflows and kept them effective under high change velocity
• Can reason from a threat model to a control and explain the tradeoff to both an engineer and an auditor
• Are energized by being the security and risk authority who educates and influences outcomes rather than only advises
• Thrive in ambiguous environments with no settled industry playbook, where you're expected to propose the standard rather than wait for one
• Deliver clear, precise written work for both technical and non-technical audiences
• Think about non-human identities as a distinct risk and control category, and can design least-privilege access and accountability controls for systems acting on a person's behalf
• Have owned or meaningfully supported efforts to compartmentalize sensitive data, PII, or intellectual property, and understand how identity and access mechanisms implement or undermine protection boundaries
• We encourage you to apply even if you do not believe you meet every single qualification
• Possess relevant certifications (CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 or ISO 42001 Lead Implementer/Auditor)
• Bring familiarity with AI governance frameworks alongside traditional security frameworks
• Have adapted controls from regulated or highly sensitive environments to an open, high-trust engineering culture
• Understand the security properties of LLM agents, whether from an AI, developer-platform, or agent-tooling company, or through comparable experience